This policy explains how INDIELINE SL ("we", "us"), the operator of ColdNina (coldnina.com), handles personal data, in accordance with the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Data controller
INDIELINE SL (NIF B56433113), C/ Mariano Cuber 17, 46011 Valencia, Spain. Contact for any privacy matter: go@indieline.xyz.
What we collect and why
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| The site URL or text you type into the demo | To run the demo you asked for: analyse it, search for matching contacts, and draft a sample email | Performance of a service you request, and your consent when you press "Run it" (Art. 6(1)(b), 6(1)(a)) |
| When you continue with Google to keep testing: your name and verified email from Google, plus the company we infer from your input, the first thing you typed (up to 500 characters), the mode you chose (raise or sales), and a count of your runs | To identify you and give you additional free runs. We only send you emails about ColdNina if you separately opt in | Steps taken at your request for the extra runs (Art. 6(1)(b)); any marketing emails only with your consent (Art. 6(1)(a)), in line with Spanish LSSI-CE Art. 21 |
| Your IP address | Rate-limiting and abuse prevention on the demo endpoint | Our legitimate interest in keeping the service secure and available (Art. 6(1)(f)) |
| Any details you give when booking a call | To schedule and hold the demo call you request | Steps taken at your request prior to a contract (Art. 6(1)(b)) |
| Your email and message if you contact us | To reply to your enquiry | Our legitimate interest in responding (Art. 6(1)(f)) |
We do not use advertising, analytics, or tracking pixels, and we set no cookies of our own. The only cookies involved are third-party sign-in cookies that Google sets on its own domain (accounts.google.com) if you choose "Continue with Google" on the Try page; we do not control those. See our Cookie Policy.
Recipients and processors
To run the demo and the site, your data may be processed by:
- Anthropic, PBC (USA): the AI model that analyses your input and drafts the sample email. Anthropic processes API inputs to return a result and, under its commercial terms, does not use them to train its models.
- Exa Labs, Inc. (USA): the web-search provider that receives a search query derived from your input to find matching public profiles.
- Google LLC (USA): if you choose "Continue with Google", Google authenticates you and confirms your name and verified email to us. We do not receive your Google password.
- Telegram (Telegram FZ-LLC): when a new user signs in, our server sends the founder an internal notification containing that user's name, email, and inferred company, so we can follow up. This message passes through Telegram's servers.
- Amazon Web Services, Inc. (AWS, region eu-central-1, Frankfurt): the cloud infrastructure we run our server on. Your lead record (name, email, company) is stored here, at rest within the EU.
- Cloudflare, Inc.: DNS for the domain.
- Notion Labs, Inc.: the calendar/booking tool used if you choose to book a call.
International transfers
Your lead record is stored on AWS in the EU (Frankfurt), but some of the providers above are outside the European Economic Area: Anthropic, Exa, Google, Cloudflare, and Notion (and AWS Inc. as a company) are in the United States, and Telegram operates on servers located internationally. Where your data is transferred outside the EEA, it is protected by appropriate GDPR safeguards where available (such as the EU-US Data Privacy Framework, Standard Contractual Clauses, and each provider's data-processing terms). For the Telegram notification, only limited contact details (name, email, company) are sent. You can request more detail, or a copy of the relevant safeguards, at go@indieline.xyz.
How long we keep it
- Demo input is processed to produce your result. The first thing you type is kept alongside your lead record only if you sign in with Google (see below); otherwise it exists only in memory for the seconds it takes to run.
- IP addresses are held only transiently, in memory, for rate-limiting (a rolling window of up to 24 hours), and are not written to persistent storage.
- Your lead record from Google sign-in (name, email, inferred company, your first input, the mode you chose, and a count of runs) is stored so we can offer extra free runs. We keep it until you ask us to delete it, or until it is no longer needed. If you opt in to updates, we keep your email for that until you unsubscribe.
- Booking and email data is kept for as long as needed to handle your request and any resulting relationship, then deleted.
Please don't submit other people's data
The demo is for your own company. Do not paste confidential information or the personal data of third parties into it. The named "matches" the demo returns are AI-generated suggestions based on public information and are illustrative only.
Children
This Service is aimed at professional and business users and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has signed in, email go@indieline.xyz and we will delete the record.
Your rights
You have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interest. Where our processing is based on your consent (for example, running the demo, or receiving updates if you opted in), you can withdraw that consent at any time, without affecting anything we did before you withdrew it. You can tell us to stop emailing you at any time, with no reason needed, by using the unsubscribe link in any message or by emailing us. To exercise any of these, email go@indieline.xyz. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).
Changes
We may update this policy. The current version is always at this page, with the "last updated" date above.